Endpoint Protection

Hello,

We recently upgraded our mac clients in our infrastructure to 10.2.3 from 10.2.1. The main reason for the upgrade was becuase we can now add our Leopard and Snow Leopard machines. The problem that we are running into is that on all the machines that have leopard and snow leopard, they are not getting updates. If we run Liveupdate, it downloads the update but then fails saying Microdefs error LiveUpdate and an error updating the virus definitions. I did all the steps that I have read in other forums about running just the LiveUpdate first and then running the Virus Defs, and I did that and I still have the problem.
I even went to symantec's web site to manually install the definitions. It says it successfully installs, but when you open up SAV, it still says 12/11/2009 for the date of the defs. I have uninstalled and re-installed the application numerous times to get it to work and still no joy. 
Has anyone have any ideas? If you need more information, I am willing to give it.

Thank you,
Luke 

It sounds like your liveupdate version is not up to date. I posted the full article below, so let me know if it helps.

Symantec AntiVirus Error: "Microdefs Error" while downloading updates through LiveUpdate
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2008011610351548

Thanks
Grant

Compatibility with Symantec AntiVirus for Macintosh 10.x and Mac OS X 10.6 Snow Leopard

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2009081911000448

Are these machines already upgraded to Snow Leopard?  Are they running in 64-bit mode?  Symantec Antivirus for Mac 10.2.3 does not support 64-bit kernel mode, as noted in the Symantec AntiVirus Read Me file that comes on the disk image.  I have observed similar behaviour on a case with the 64-bit kernel loaded (defs appear to install, but the date never changes).

If not, what is the version of LiveUpdate (/Applicaitons/Symantec Solutions/LiveUpdate, Get Info)?

Are these machines connecting to Symantec's LiveUpdate servers, or to an internal server?

Thanks,
sandra

Sorry, I just saw that this is happening on Leopard, too.

Thanks,
Sandra

On 10.5.8 and 10.6 and 10.6.2 clients.

We're trying to get a SAV 10.2.3 SACM up and running to manage our Macs and so far we've had issues with LiveUpdate tasks. The icon pops up in the dock of the target machine (any way that can be 'silenced?') and just sits there, for hours if we don't kill it. It takes no CPU and doesn't seem to be doing much. In the console log there are no traces of it doing much of anything. And the server still thinks the process is churning. 

But if we kill LiveUpdate on the target machine, open up LiveUpdate manually and check the log, everything is 'current'. If we open Symantec Antivirus the window claims that the defs are stuck at 12/11/09. And suddenly the server thinks the process completed successfully.

Any thoughts?

Thanks,
kirk...

This can occur when a command is sent to a machine that is turned off or logged out at the time the LiveUpdate command is sent.  I believe this is due, in part, to security restrictions in the OS that any application capable of generating a window is not allowed to launch if no one is logged in.

Title: 'LiveUpdate does not properly exit when commanded from the Symantec Administration Console for Macintosh'
Document ID: 2008101511243848
> Web URL: http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2008101511243848

(I have seen it where the LiveUpdate icon is present in the dock and doesn't go away, like you describe.)

If it is common that users turn off or log out of their machines when not working on them, I would recommend sending LiveUpdate schedules rather than sending LiveUpdate commands every day.

Unfortunately you do have to dabble a little in symsched command line stuff, but the good thing is that you can save the command line as a template, then send the command with the schedule as many times as needed.

Title: 'How to remotely schedule LiveUpdate and virus scans on Symantec AntiVirus for Macintosh 10.x clients'
Document ID: 2007393022179698
> Web URL: http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2007393022179698

What happens if you manually launch LiveUpdate on a client machine, and run it for virus definitions?  If the defs are themselves corrupted, you'll probably want to obtain the Intelligent Updater to fix 'em.  Just get the right one for your processor type.

http://www.symantec.com/business/security_response/definitions/download/detail.jsp?gid=nmc

Hope this helps,
sandra

Thanks for the info on the 'logged off' issue - I sent the command when logged into the machine and LU just ran without issue on the Leopard machine. I double checked with the Snow Leopard machine as well and all seems to be working as long as we're logged in.
Thanks!
kirk...